1. How should Disclosure Reports work in the future?
Contract Management Committee on 20th March 2019

2. Introduction This agenda item is for discussion not approval
Prompted by lessons learned from the progress of AltHANCo Disclosure Report, we would like to discuss how we can improve the process of Disclosure Reports by looking at the following:
Re-confirm the aim and purpose of the Disclosure Report
The responsibilities for each party associated with the process of considering additional disclosures of information including what the responsibilities are of each party
How could the structure of the report be improved to align with the aim and enable more efficient decision making?
Whether the Disclosure Report template be improved by being clearer about who is responsible for providing input into it and who is responsible for completing it and scoring the risk.

3. What is the purpose of Disclosure Requests?
Outline how the disclosure will be delivered and the process by which it’ll be delivered,
Identify the commercial, security and privacy risks of the service.
And present these findings to CoMC so they can make the final risk assessment and approve/defer/reject

4. Roles and Responsibilities
Who is responsible for the completion, management and delivery of Disclosure Requests, and who provides consultancy?
We have suggested a RACI for CoMC to review; if agreed, we’ll work with the Contract Managers to embed the RACI
Xoserve’s suggestions can be found on the next slide

5. Ideas for a Disclosure Request RACI
If we define RACI by the following, we have come up with two concepts the assignment of ownership:
R – Responsible - Takes ownership for the completion and population of the Disclosure Request, and its provision to CoMC for approval; the party responsible can do this using input from the Content Provider
A – Accountable - Approval of the Disclosure Request
C – Content Provider – Provides the party responsible with information about risks, delivery mechanisms, process of the service, etc.
I – Informed – Informed of the progress with the Disclosure Request
Concept 1
Concept 2
GT Sponsor
CoMC
Xoserve
GT Sponsor
Xoserve
CoMC
GT Sponsor
Xoserve R A C I R A C I

6. Summary
Regardless of which concept is preferred, there needs to be collaboration in the development of the Disclosure Request between Xoserve and the GTs
As there are multiple GTs, we are considering whether it would be a good idea to rotate a GT sponsor for each Disclosure Request; therefore, there would be a single GT associated with the development of each Disclosure Request
We are also thinking about whether a CoMC sub-group would be useful to support the development of Disclosure Requests
As part of the improvement initiative, we’ll also ask the GTs to agree on a DPIA template to be included in each Disclosure Request

7. Next Steps
Xoserve to seek confirmation of the above suggestions, and feedback, from the Contract Managers
Does CoMC have any contacts for us to check our framework? Think about who you need in order to support your decision at CoMC
Does CoMC have any thoughts on the above slides?